looks like update might be a single document api and for muti document you have to use update_query_by, is this correct, according to this doc,
https://www.elastic.co/guide/en/elasticsearch/reference/6.3/docs.html
if so i ran this now
POST filebeat-6.0.0-2018.12.17/_update_by_query
{
"query": {
"match_all": {}
},
"script": {
"source": "ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).plusYears(1)",
"lang": "painless"
}
}
and got this
{
"error": {
"root_cause": [
{
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"java.util.Objects.requireNonNull(Objects.java:228)",
"java.time.format.DateTimeFormatter.parse(DateTimeFormatter.java:1848)",
"java.time.OffsetDateTime.parse(OffsetDateTime.java:402)",
"java.time.OffsetDateTime.parse(OffsetDateTime.java:387)",
"ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).plusYears(1)",
" ^---- HERE"
],
"script": "ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).plusYears(1)",
"lang": "painless"
}
],
"type": "script_exception",
"reason": "runtime error",
"script_stack": [
"java.util.Objects.requireNonNull(Objects.java:228)",
"java.time.format.DateTimeFormatter.parse(DateTimeFormatter.java:1848)",
"java.time.OffsetDateTime.parse(OffsetDateTime.java:402)",
"java.time.OffsetDateTime.parse(OffsetDateTime.java:387)",
"ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).plusYears(1)",
" ^---- HERE"
],
"script": "ctx._source.timestamp = OffsetDateTime.parse(ctx._source.timestamp).plusYears(1)",
"lang": "painless",
"caused_by": {
"type": "null_pointer_exception",
"reason": "text"
}
},
"status": 500
}
looks like I'm back to square one were the query by is getting a null for the results but when i do a _search query on that i get hits?
{
"took": 3,
"timed_out": false,
"_shards": {
"total": 5,
"successful": 5,
"skipped": 0,
"failed": 0
},
"hits": {
"total": 82199,
"max_score": 1,
"hits": [
{